The flaw lies in CRI‑O's handling of container creation environment variables. When a CreateContainer request supplies a nil Envs field, CRI‑O uses unfiltered values from the target OCI image’s config.Env. If an image contains an Env entry lacking an '=' sign, the daemon attempts to split the entry improperly, leading to an out‑of‑range index and an unrecovered Go runtime panic that crashes the crio daemon. This shutdown terminates the container‑runtime service and brings down all workloads running on the node, effectively causing a denial of service. The weakness corresponds to CWE‑1287, involving unvalidated input leading to a crash.

The affected product is Red Hat OpenShift Container Platform 4, which incorporates the CRI‑O container runtime. All installations of this platform that use CRI‑O are susceptible when they deploy OCI images with malformed environment variables.

The CVSS score of 6.0 indicates a moderate severity. EPSS is not available, but the lack of a KEV listing and the requirement to supply a malicious OCI image suggest the exploitation probability is low to moderate. Attacks would likely occur if an attacker can push or modify images used by OpenShift, meaning that privileged access to the image registry or build pipeline is required. The work‑in‑progress crash of the daemon presents an opportunity for a denial‑of‑service attack, but discovery and deployment of the vulnerable image are necessary prerequisites.